There was a time I found some organizations to be paranoid about enabling it because it was mentioned in either CIS or NIST hardening but it ignores the fact that the same information can be gathered with other tools so I suppose it depends on if you have to follow a standard that still says sysrq is a risk and if your SOC1/SOC2 documentation refers to those standards as part of your audits. But in reality if that were a risk then there are a myriad of other things that would have to be disabled as well and some of those things require recompiling the kernel to disable.